- credential-sync callbacks compare the epoch captured when their
request was issued instead of a shared cell the reset itself
rewrote, so a stale callback can no longer pass as current; the
first identified partition reload also restarts the sync flow,
clearing the in-flight latch a mount-time policy fetch left wedged
- AI standard-turn commits (snapshot replace, starter clear, modify
apply, doc sink) each take a write pass at the commit instant — the
streamed conversation never holds the barrier — and a closed
barrier leaves the document untouched while the reply still
streams; /api/ai/stream was verified to have no commit points
- the shutdown write drain has no ceiling: flush runs only once no
write is in flight, with escalating logs and stop_grace_period
documented as the one true upper bound
- LocalEditOutcome::Failed reports whether the document rolled back,
and the thumbnail snapshot is restored only when it did — the
delivery-failure fallback keeps the edited document, so restoring
old thumbnails there described a document that no longer existed
055db1895f